CVE-2022-30333

rarlab unrar, debian linux

Published 9 May 2022 · updated 2 Oct 2026 · Analyzed

7.5 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 9 Aug 2022, with a remediation deadline of 30 Aug 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

References

packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html · Exploit, Third Party Advisory, VDB Entry
blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/ · Exploit, Third Party Advisory
lists.debian.org/debian-lts-announce/2023/08/msg00022.html · Mailing List, Third Party Advisory
security.gentoo.org/glsa/202309-04 · Third Party Advisory
www.rarlab.com/rar/rarlinux-x32-612.tar.gz · Patch
www.rarlab.com/rar_add.htm · Product
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333 · US Government Resource